In my previous post in this series, we discussed that a "SIEM" is defined as a group of complex technologies that together, provide a centralized bird's-eye-view into an infrastructure. Furthermore, it provides analysis and workflow, correlation, normalization, aggregation and reporting, as well as log management. In this next post, I hope to answer...

"123456" and "password" were the most-used and second most-used passwords of 2015, according to an annual worst passwords ranking. Every year, SplashData, a developer of password management software, releases an annual list of the worst--in this case, most commonly used--passwords. It builds its ranking based on more than two million leaked...

Looking for a great information security podcast? There are plenty to choose from! Here’s a roundup of currently active information security podcasts. The list is split into two categories: podcasts run by people representing themselves (meaning they are not speaking for a company) and podcasts produced under the name of a company. I made the...

Today’s VERT Alert addresses 9 new Microsoft Security Bulletins. VERT is actively working on coverage for these bulletins in order to meet our 24-hour SLA and expects to ship ASPL-652 on Wednesday, January 13th. Ease of Use (published exploits) to Risk Table Automated Exploit Easy ...

Time Warner Cable (TWC) is planning to notify 320,000 of its customers whose account information might have been compromised. The American cable telecommunications company first learned of the issue after the Federal Bureau of Investigations (FBI) reached out and alerted them to the fact that some of their customers' email addresses and passwords...

A group of researchers has made public a database, dubbed "SCADAPASS," containing default credentials for more than 100 industrial control system (ICS) products belonging to various top vendors. The research team—known as SCADA StrangeLove—published the list on GitHub, which includes the product and vendor names; device type; default username and...

These days, consumers are constantly being pushed to move away from paper correspondence and communication to an electronic alternative. Every time I sign into my bank account, I’m reminded of my option to forego the physical receipt of my monthly statement and go paperless. While the benefits of going paperless are clear to both businesses and...

Some of the world's most popular news and entertainment websites have been spreading poisoned adverts to potentially hundreds of thousands of visitors, putting innocent readers at risk of having their computers hit by threats such as ransomware. Famous sites which displayed the malicious ads and endangered visiting computers include MSN, bbc.com,...

21st Century Oncology, a Florida-based chain of 181 cancer treatment centers in the US and Latin America, announced earlier this month that an unauthorized intrusion into one of its databases may have exposed patient information. In a Securities and Exchange Commission filing, the clinic said it is...

China has called for increased cooperation with the FBI on matters pertaining to internet security and counterterrorism. Reuters reports that Guo Shengkun, China's minister of public safety, recently told FBI Director James Comey in a Beijing meeting that his country was willing to enhance its mutual trust and respect with the United States with...

What is SCM? Well, let’s start with what it stands for. Generally, it represents "Security Configuration Management," but it is also referred to as "Secure Configuration Management." Both are equally acceptable and mean the same thing. SCM exists at the point where IT Security and IT Operations meet. It’s a software-based solution that aims to...

In Part 1 of this article series, we considered the specific elements that make up the game of chess and how they parallel the core elements of effective security programs. In Part 2, we’ll look at some fundamental chess concepts, such as time, space, material and structure, and how these ideas parallel concepts in security. We’ll also cover the...

What you are about to read is not from 1995. This is not Throwback Thursday. What follows is an account of the first full day of booth duty at Healthcare Information and Management Systems Society (HIMSS) 2016 conference in sunny Las Vegas. For those of you who have never heard of HIMSS, (I certainly hadn’t until my boss asked me to attend.) it is a...

The recent announcement from the Payment Card Industry Security Standards Council (PCI SSC) that it will be moving the PCI 3.1 deadline to June 2018 – giving an extra 24 months – caught my attention and reminded me of the ongoing dance between compliance and security. From a compliance and operational standpoint, the new deadline gives organizations...

The popular video messaging application Snapchat has responded to a partial leak of its former and current employees' payroll information following a recent phishing attack. On Monday, Team Snapchat published a statement on their company's blog: "We’re a company that takes privacy and security seriously," the statement begins. "So it’s with real...

In the first installment of this two-part article series, we took a brief look at the influence of Sun Tzu’s The Art of War and began our exploration of the theme of deception in warfare as it relates to cyber and information security. Let’s move on to another high-level theme running through the text: the importance of agility and variation in...

GoDaddy has remediated a blind cross-site scripting (XSS) vulnerability that attackers could have used to take over, modify, or delete users' accounts. Security researcher Matthew Bryant discovered the flaw using a tool XSS Hunter late last year. At that time, he found he could set his first and last name to an XSS payload. He opted to use a generic...

We tend to fear what we do not understand. Especially when it comes to new technologies. We oftentimes worry… and worry some more… before finally embracing a new gadget, platform, or feature and deciding to incorporate it into our lives. Brian David Johnson, futurist at Intel, is responsible for creating models that predict how people will interact...

Baby retailer Kiddicare has alerted nearly 800,000 customers that a recent data breach led to the exposure of their personal information. The UK-based company notified potentially affected customers via email, stating that the compromised information included names, delivery addresses, emails and phone numbers. Kiddicare stressed that the...

2016 marks the ninth year Verizon has published its annual Data Breach Investigations Report (DBIR). Once again, organizations sent their data on thousands of security incidents and data breaches to Verizon, whose researchers analyzed that information to highlight new patterns, steady trends, and interesting tidbits in the evolving digital threat...